sendnrw/siem-backend
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Funktionsrollback
Some checks failed
release-tag / release-image (push) Failing after 1m8s
Details

Browse Source
This commit is contained in:
jbergner
2026-07-24 07:17:38 +02:00
parent a4ff984914
commit e9d9583f28
38 changed files with 3243 additions and 364 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
deploy/clickhouse/init.sql.template
View File

@@ -80,3 +80,14 @@ CREATE MATERIALIZED VIEW IF NOT EXISTS __CLICKHOUSE_DB__.events_5m_mv TO __CLICK
SELECT tenant_id, toStartOfInterval(event_time, INTERVAL 5 MINUTE) AS bucket, host_name, event_code, category, action, outcome, uniqExactState(event_uid) AS cnt_state
FROM __CLICKHOUSE_DB__.events
GROUP BY tenant_id, bucket, host_name, event_code, category, action, outcome;
-- Dedicated Grafana account. It receives SELECT only. readonly=2 lets the
-- datasource client change query settings such as max_execution_time; ClickHouse itself
-- remains bound to localhost by default and the role has no write privileges.
CREATE ROLE IF NOT EXISTS siem_grafana_role;
ALTER ROLE siem_grafana_role SETTINGS readonly = 2, max_execution_time = 30, max_threads = 4, max_memory_usage = 2000000000;
GRANT SELECT ON __CLICKHOUSE_DB__.* TO siem_grafana_role;
CREATE USER IF NOT EXISTS grafana_reader IDENTIFIED WITH sha256_password BY '__GRAFANA_CLICKHOUSE_PASSWORD__';
ALTER USER grafana_reader IDENTIFIED WITH sha256_password BY '__GRAFANA_CLICKHOUSE_PASSWORD__';
GRANT siem_grafana_role TO grafana_reader;
ALTER USER grafana_reader DEFAULT ROLE siem_grafana_role;

461
deploy/grafana/dashboards/pipeline-health.json Normal file
View File

@@ -0,0 +1,461 @@
{
"annotations": {
"list": []
},
"editable": true,
"graphTooltip": 1,
"id": null,
"links": [],
"panels": [
{
"id": 1,
"title": "Ingress erreichbar",
"type": "stat",
"gridPos": {
"x": 0,
"y": 0,
"w": 6,
"h": 4
},
"datasource": {
"type": "prometheus",
"uid": "siem-prometheus"
},
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "siem-prometheus"
},
"expr": "up{job=\"siem-ingress\"}",
"legendFormat": "",
"refId": "A",
"range": true
}
],
"fieldConfig": {
"defaults": {
"unit": "short",
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": []
},
"options": {
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"orientation": "auto",
"textMode": "auto",
"colorMode": "value",
"graphMode": "area"
}
},
{
"id": 2,
"title": "Redpanda erreichbar",
"type": "stat",
"gridPos": {
"x": 6,
"y": 0,
"w": 6,
"h": 4
},
"datasource": {
"type": "prometheus",
"uid": "siem-prometheus"
},
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "siem-prometheus"
},
"expr": "up{job=\"redpanda\"}",
"legendFormat": "",
"refId": "A",
"range": true
}
],
"fieldConfig": {
"defaults": {
"unit": "short",
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": []
},
"options": {
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"orientation": "auto",
"textMode": "auto",
"colorMode": "value",
"graphMode": "area"
}
},
{
"id": 3,
"title": "ClickHouse erreichbar",
"type": "stat",
"gridPos": {
"x": 12,
"y": 0,
"w": 6,
"h": 4
},
"datasource": {
"type": "prometheus",
"uid": "siem-prometheus"
},
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "siem-prometheus"
},
"expr": "up{job=\"clickhouse\"}",
"legendFormat": "",
"refId": "A",
"range": true
}
],
"fieldConfig": {
"defaults": {
"unit": "short",
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": []
},
"options": {
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"orientation": "auto",
"textMode": "auto",
"colorMode": "value",
"graphMode": "area"
}
},
{
"id": 4,
"title": "Akzeptierte Events / s",
"type": "stat",
"gridPos": {
"x": 18,
"y": 0,
"w": 6,
"h": 4
},
"datasource": {
"type": "prometheus",
"uid": "siem-prometheus"
},
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "siem-prometheus"
},
"expr": "rate(siem_ingress_events_accepted_total[5m])",
"legendFormat": "",
"refId": "A",
"range": true
}
],
"fieldConfig": {
"defaults": {
"unit": "short",
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": []
},
"options": {
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"orientation": "auto",
"textMode": "auto",
"colorMode": "value",
"graphMode": "area"
}
},
{
"id": 5,
"title": "Ingest-Batches / s",
"type": "timeseries",
"gridPos": {
"x": 0,
"y": 4,
"w": 12,
"h": 8
},
"datasource": {
"type": "prometheus",
"uid": "siem-prometheus"
},
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "siem-prometheus"
},
"expr": "rate(siem_ingress_batches_total[5m])",
"legendFormat": "",
"refId": "A",
"range": true
}
],
"fieldConfig": {
"defaults": {
"unit": "eps",
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": []
},
"options": {
"legend": {
"displayMode": "list",
"placement": "bottom",
"showLegend": true
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
}
},
{
"id": 6,
"title": "Abgewiesene Requests / s",
"type": "timeseries",
"gridPos": {
"x": 12,
"y": 4,
"w": 12,
"h": 8
},
"datasource": {
"type": "prometheus",
"uid": "siem-prometheus"
},
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "siem-prometheus"
},
"expr": "rate(siem_ingress_requests_rejected_total[5m])",
"legendFormat": "",
"refId": "A",
"range": true
}
],
"fieldConfig": {
"defaults": {
"unit": "Bps",
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": []
},
"options": {
"legend": {
"displayMode": "list",
"placement": "bottom",
"showLegend": true
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
}
},
{
"id": 7,
"title": "ClickHouse Scrape-Latenz",
"type": "timeseries",
"gridPos": {
"x": 0,
"y": 12,
"w": 12,
"h": 8
},
"datasource": {
"type": "prometheus",
"uid": "siem-prometheus"
},
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "siem-prometheus"
},
"expr": "scrape_duration_seconds{job=\"clickhouse\"}",
"legendFormat": "",
"refId": "A",
"range": true
}
],
"fieldConfig": {
"defaults": {
"unit": "bytes",
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": []
},
"options": {
"legend": {
"displayMode": "list",
"placement": "bottom",
"showLegend": true
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
}
},
{
"id": 8,
"title": "Redpanda Scrape-Latenz",
"type": "timeseries",
"gridPos": {
"x": 12,
"y": 12,
"w": 12,
"h": 8
},
"datasource": {
"type": "prometheus",
"uid": "siem-prometheus"
},
"targets": [
{
"datasource": {
"type": "prometheus",
"uid": "siem-prometheus"
},
"expr": "scrape_duration_seconds{job=\"redpanda\"}",
"legendFormat": "",
"refId": "A",
"range": true
}
],
"fieldConfig": {
"defaults": {
"unit": "short",
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": []
},
"options": {
"legend": {
"displayMode": "list",
"placement": "bottom",
"showLegend": true
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
}
}
],
"refresh": "15s",
"schemaVersion": 42,
"tags": [
"siem",
"pipeline",
"prometheus"
],
"templating": {
"list": []
},
"time": {
"from": "now-6h",
"to": "now"
},
"timezone": "browser",
"title": "SIEM Pipeline Health",
"uid": "siem-pipeline-health",
"version": 2
}

550
deploy/grafana/dashboards/security-overview.json Normal file
View File

@@ -0,0 +1,550 @@
{
"annotations": {
"list": []
},
"editable": true,
"fiscalYearStartMonth": 0,
"graphTooltip": 1,
"id": null,
"links": [],
"panels": [
{
"id": 1,
"title": "Events im Zeitraum",
"type": "stat",
"gridPos": {
"x": 0,
"y": 0,
"w": 6,
"h": 4
},
"datasource": {
"type": "grafana-clickhouse-datasource",
"uid": "siem-clickhouse"
},
"targets": [
{
"datasource": {
"type": "grafana-clickhouse-datasource",
"uid": "siem-clickhouse"
},
"editorType": "sql",
"format": 0,
"queryType": "table",
"rawSql": "SELECT uniqExact(event_uid) AS value FROM siem.events WHERE $__timeFilter(event_time)",
"refId": "A"
}
],
"fieldConfig": {
"defaults": {
"unit": "short",
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": []
},
"options": {
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"orientation": "auto",
"textMode": "auto",
"colorMode": "value",
"graphMode": "area"
}
},
{
"id": 2,
"title": "Aktive Hosts",
"type": "stat",
"gridPos": {
"x": 6,
"y": 0,
"w": 6,
"h": 4
},
"datasource": {
"type": "grafana-clickhouse-datasource",
"uid": "siem-clickhouse"
},
"targets": [
{
"datasource": {
"type": "grafana-clickhouse-datasource",
"uid": "siem-clickhouse"
},
"editorType": "sql",
"format": 0,
"queryType": "table",
"rawSql": "SELECT uniqExact(host_name) AS value FROM siem.events WHERE $__timeFilter(event_time)",
"refId": "A"
}
],
"fieldConfig": {
"defaults": {
"unit": "short",
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": []
},
"options": {
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"orientation": "auto",
"textMode": "auto",
"colorMode": "value",
"graphMode": "area"
}
},
{
"id": 3,
"title": "Failed Logons",
"type": "stat",
"gridPos": {
"x": 12,
"y": 0,
"w": 6,
"h": 4
},
"datasource": {
"type": "grafana-clickhouse-datasource",
"uid": "siem-clickhouse"
},
"targets": [
{
"datasource": {
"type": "grafana-clickhouse-datasource",
"uid": "siem-clickhouse"
},
"editorType": "sql",
"format": 0,
"queryType": "table",
"rawSql": "SELECT uniqExact(event_uid) AS value FROM siem.events WHERE $__timeFilter(event_time) AND event_code=4625",
"refId": "A"
}
],
"fieldConfig": {
"defaults": {
"unit": "short",
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": []
},
"options": {
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"orientation": "auto",
"textMode": "auto",
"colorMode": "value",
"graphMode": "area"
}
},
{
"id": 4,
"title": "Account Lockouts",
"type": "stat",
"gridPos": {
"x": 18,
"y": 0,
"w": 6,
"h": 4
},
"datasource": {
"type": "grafana-clickhouse-datasource",
"uid": "siem-clickhouse"
},
"targets": [
{
"datasource": {
"type": "grafana-clickhouse-datasource",
"uid": "siem-clickhouse"
},
"editorType": "sql",
"format": 0,
"queryType": "table",
"rawSql": "SELECT uniqExact(event_uid) AS value FROM siem.events WHERE $__timeFilter(event_time) AND event_code=4740",
"refId": "A"
}
],
"fieldConfig": {
"defaults": {
"unit": "short",
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": []
},
"options": {
"reduceOptions": {
"calcs": [
"lastNotNull"
],
"fields": "",
"values": false
},
"orientation": "auto",
"textMode": "auto",
"colorMode": "value",
"graphMode": "area"
}
},
{
"id": 5,
"title": "Event-Volumen",
"type": "timeseries",
"gridPos": {
"x": 0,
"y": 4,
"w": 24,
"h": 8
},
"datasource": {
"type": "grafana-clickhouse-datasource",
"uid": "siem-clickhouse"
},
"targets": [
{
"datasource": {
"type": "grafana-clickhouse-datasource",
"uid": "siem-clickhouse"
},
"editorType": "sql",
"format": 0,
"queryType": "timeseries",
"rawSql": "SELECT $__timeInterval(event_time) AS time, uniqExact(event_uid) AS events FROM siem.events WHERE $__timeFilter(event_time) GROUP BY time ORDER BY time",
"refId": "A"
}
],
"fieldConfig": {
"defaults": {
"unit": "short",
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": []
},
"options": {
"legend": {
"displayMode": "list",
"placement": "bottom",
"showLegend": true
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
}
},
{
"id": 6,
"title": "Top Hosts",
"type": "table",
"gridPos": {
"x": 0,
"y": 12,
"w": 12,
"h": 8
},
"datasource": {
"type": "grafana-clickhouse-datasource",
"uid": "siem-clickhouse"
},
"targets": [
{
"datasource": {
"type": "grafana-clickhouse-datasource",
"uid": "siem-clickhouse"
},
"editorType": "sql",
"format": 0,
"queryType": "table",
"rawSql": "SELECT host_name AS Host, uniqExact(event_uid) AS Events FROM siem.events WHERE $__timeFilter(event_time) GROUP BY host_name ORDER BY Events DESC LIMIT 20",
"refId": "A"
}
],
"fieldConfig": {
"defaults": {
"unit": "short",
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": []
},
"options": {
"showHeader": true,
"cellHeight": "sm"
}
},
{
"id": 7,
"title": "Top Event-IDs",
"type": "table",
"gridPos": {
"x": 12,
"y": 12,
"w": 12,
"h": 8
},
"datasource": {
"type": "grafana-clickhouse-datasource",
"uid": "siem-clickhouse"
},
"targets": [
{
"datasource": {
"type": "grafana-clickhouse-datasource",
"uid": "siem-clickhouse"
},
"editorType": "sql",
"format": 0,
"queryType": "table",
"rawSql": "SELECT event_code AS EventID, uniqExact(event_uid) AS Events FROM siem.events WHERE $__timeFilter(event_time) GROUP BY event_code ORDER BY Events DESC LIMIT 20",
"refId": "A"
}
],
"fieldConfig": {
"defaults": {
"unit": "short",
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": []
},
"options": {
"showHeader": true,
"cellHeight": "sm"
}
},
{
"id": 8,
"title": "Authentication Events",
"type": "timeseries",
"gridPos": {
"x": 0,
"y": 20,
"w": 24,
"h": 8
},
"datasource": {
"type": "grafana-clickhouse-datasource",
"uid": "siem-clickhouse"
},
"targets": [
{
"datasource": {
"type": "grafana-clickhouse-datasource",
"uid": "siem-clickhouse"
},
"editorType": "sql",
"format": 0,
"queryType": "timeseries",
"rawSql": "SELECT $__timeInterval(event_time) AS time, toString(event_code) AS event, uniqExact(event_uid) AS events FROM siem.events WHERE $__timeFilter(event_time) AND event_code IN (4624,4625,4740,4771,4776) GROUP BY time,event ORDER BY time",
"refId": "A"
}
],
"fieldConfig": {
"defaults": {
"unit": "short",
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": []
},
"options": {
"legend": {
"displayMode": "list",
"placement": "bottom",
"showLegend": true
},
"tooltip": {
"mode": "multi",
"sort": "desc"
}
}
},
{
"id": 9,
"title": "Top fehlgeschlagene Benutzer",
"type": "table",
"gridPos": {
"x": 0,
"y": 28,
"w": 12,
"h": 8
},
"datasource": {
"type": "grafana-clickhouse-datasource",
"uid": "siem-clickhouse"
},
"targets": [
{
"datasource": {
"type": "grafana-clickhouse-datasource",
"uid": "siem-clickhouse"
},
"editorType": "sql",
"format": 0,
"queryType": "table",
"rawSql": "SELECT target_user AS User, uniqExact(event_uid) AS Failures, uniqExact(source_ip) AS SourceIPs FROM siem.events WHERE $__timeFilter(event_time) AND event_code=4625 AND target_user!='' GROUP BY target_user ORDER BY Failures DESC LIMIT 25",
"refId": "A"
}
],
"fieldConfig": {
"defaults": {
"unit": "short",
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": []
},
"options": {
"showHeader": true,
"cellHeight": "sm"
}
},
{
"id": 10,
"title": "Top Source-IPs bei 4625",
"type": "table",
"gridPos": {
"x": 12,
"y": 28,
"w": 12,
"h": 8
},
"datasource": {
"type": "grafana-clickhouse-datasource",
"uid": "siem-clickhouse"
},
"targets": [
{
"datasource": {
"type": "grafana-clickhouse-datasource",
"uid": "siem-clickhouse"
},
"editorType": "sql",
"format": 0,
"queryType": "table",
"rawSql": "SELECT source_ip AS SourceIP, uniqExact(event_uid) AS Failures, uniqExact(target_user) AS Users FROM siem.events WHERE $__timeFilter(event_time) AND event_code=4625 AND source_ip!='' GROUP BY source_ip ORDER BY Failures DESC LIMIT 25",
"refId": "A"
}
],
"fieldConfig": {
"defaults": {
"unit": "short",
"thresholds": {
"mode": "absolute",
"steps": [
{
"color": "green",
"value": null
}
]
}
},
"overrides": []
},
"options": {
"showHeader": true,
"cellHeight": "sm"
}
}
],
"refresh": "30s",
"schemaVersion": 42,
"tags": [
"siem",
"security",
"clickhouse"
],
"templating": {
"list": []
},
"time": {
"from": "now-24h",
"to": "now"
},
"timezone": "browser",
"title": "SIEM Security Overview",
"uid": "siem-security-overview",
"version": 1
}

12
deploy/grafana/provisioning/dashboards/siem.yml Normal file
View File

@@ -0,0 +1,12 @@
apiVersion: 1
providers:
- name: Greenfield SIEM
orgId: 1
folder: Greenfield SIEM
folderUid: greenfield-siem
type: file
disableDeletion: false
updateIntervalSeconds: 30
allowUiUpdates: true
options:
path: /var/lib/grafana/dashboards

29
deploy/grafana/provisioning/datasources/siem.yml Normal file
View File

@@ -0,0 +1,29 @@
apiVersion: 1
prune: true
datasources:
- name: SIEM ClickHouse
uid: siem-clickhouse
type: grafana-clickhouse-datasource
access: proxy
isDefault: true
editable: false
jsonData:
host: clickhouse
port: 9000
protocol: native
username: grafana_reader
defaultDatabase: $CLICKHOUSE_DB
defaultTable: events
queryTimeout: 30
dialTimeout: 10
validateSql: true
enableRowLimit: true
secureJsonData:
password: $CLICKHOUSE_GRAFANA_PASSWORD
- name: SIEM Prometheus
uid: siem-prometheus
type: prometheus
access: proxy
url: http://prometheus:9090
isDefault: false
editable: false

56
deploy/postgres/init.sql
View File

@@ -1,4 +1,5 @@
CREATE EXTENSION IF NOT EXISTS pgcrypto;
CREATE TABLE IF NOT EXISTS agents (
id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
tenant_id text NOT NULL,
@@ -12,10 +13,58 @@ CREATE TABLE IF NOT EXISTS agents (
);
CREATE INDEX IF NOT EXISTS agents_last_seen_idx ON agents(tenant_id,last_seen DESC);
CREATE TABLE IF NOT EXISTS rule_sets (
tenant_id text NOT NULL,
id text NOT NULL,
name text NOT NULL,
description text NOT NULL DEFAULT '',
version integer NOT NULL DEFAULT 1,
enabled boolean NOT NULL DEFAULT true,
source text NOT NULL DEFAULT 'builtin',
locked boolean NOT NULL DEFAULT false,
created_at timestamptz NOT NULL DEFAULT now(),
updated_at timestamptz NOT NULL DEFAULT now(),
PRIMARY KEY (tenant_id,id)
);
CREATE TABLE IF NOT EXISTS detection_rules (
tenant_id text NOT NULL,
id text NOT NULL,
rule_set_id text NOT NULL,
title text NOT NULL,
severity text NOT NULL,
score double precision NOT NULL DEFAULT 0,
enabled boolean NOT NULL DEFAULT true,
source text NOT NULL DEFAULT 'builtin',
definition jsonb NOT NULL,
created_at timestamptz NOT NULL DEFAULT now(),
updated_at timestamptz NOT NULL DEFAULT now(),
PRIMARY KEY (tenant_id,id),
FOREIGN KEY (tenant_id,rule_set_id) REFERENCES rule_sets(tenant_id,id) ON DELETE CASCADE
);
CREATE INDEX IF NOT EXISTS detection_rules_set_idx ON detection_rules(tenant_id,rule_set_id,enabled);
CREATE INDEX IF NOT EXISTS detection_rules_severity_idx ON detection_rules(tenant_id,severity,enabled);
CREATE TABLE IF NOT EXISTS detection_suppressions (
id bigserial PRIMARY KEY,
tenant_id text NOT NULL,
rule_id text NOT NULL DEFAULT '',
host_pattern text NOT NULL DEFAULT '',
user_pattern text NOT NULL DEFAULT '',
source_ip_pattern text NOT NULL DEFAULT '',
reason text NOT NULL DEFAULT '',
enabled boolean NOT NULL DEFAULT true,
expires_at timestamptz,
created_at timestamptz NOT NULL DEFAULT now()
);
CREATE INDEX IF NOT EXISTS detection_suppressions_active_idx ON detection_suppressions(tenant_id,enabled,expires_at);
CREATE TABLE IF NOT EXISTS detections (
id bigserial PRIMARY KEY,
tenant_id text NOT NULL,
fingerprint char(64) NOT NULL,
rule_id text NOT NULL DEFAULT '',
rule_set_id text NOT NULL DEFAULT '',
rule_name text NOT NULL,
severity text NOT NULL,
status text NOT NULL DEFAULT 'open',
@@ -29,10 +78,17 @@ CREATE TABLE IF NOT EXISTS detections (
window_end timestamptz NOT NULL,
summary text NOT NULL,
hit_count bigint NOT NULL DEFAULT 1,
tags jsonb NOT NULL DEFAULT '[]'::jsonb,
mitre jsonb NOT NULL DEFAULT '[]'::jsonb,
first_seen timestamptz NOT NULL DEFAULT now(),
last_seen timestamptz NOT NULL DEFAULT now(),
updated_at timestamptz NOT NULL DEFAULT now(),
UNIQUE (tenant_id, fingerprint)
);
ALTER TABLE detections ADD COLUMN IF NOT EXISTS rule_id text NOT NULL DEFAULT '';
ALTER TABLE detections ADD COLUMN IF NOT EXISTS rule_set_id text NOT NULL DEFAULT '';
ALTER TABLE detections ADD COLUMN IF NOT EXISTS tags jsonb NOT NULL DEFAULT '[]'::jsonb;
ALTER TABLE detections ADD COLUMN IF NOT EXISTS mitre jsonb NOT NULL DEFAULT '[]'::jsonb;
CREATE INDEX IF NOT EXISTS detections_open_idx ON detections(tenant_id,status,last_seen DESC);
CREATE INDEX IF NOT EXISTS detections_rule_idx ON detections(tenant_id,rule_name,last_seen DESC);
CREATE INDEX IF NOT EXISTS detections_rule_id_idx ON detections(tenant_id,rule_id,last_seen DESC);

99
deploy/rules/windows-account-admin.json Normal file
View File

@@ -0,0 +1,99 @@
{
"id": "windows-account-admin",
"name": "Windows Account & Privilege Management",
"description": "Konten, Gruppen und privilegierte Änderungen.",
"version": 1,
"enabled": true,
"rules": [
{
"id": "win-privileged-group-change",
"title": "Privilegierte Gruppenmitgliedschaft geändert",
"description": "Mitglied zu privilegierter lokaler, globaler oder universeller Gruppe hinzugefügt.",
"severity": "critical",
"score": 9.2,
"enabled": true,
"kind": "event",
"channels": ["Security"],
"event_codes": [4728, 4732, 4756],
"group_by": ["host", "user", "workstation"],
"threshold": 1,
"window_seconds": 300,
"suppress_seconds": 900,
"summary": "Privilegierte Gruppenmitgliedschaft geändert: {user} auf {host}",
"tags": ["windows", "privilege", "account-management"],
"mitre": ["T1098"]
},
{
"id": "win-user-created",
"title": "Benutzerkonto erstellt",
"description": "Windows Security Event 4720.",
"severity": "medium",
"score": 6.0,
"enabled": true,
"kind": "event",
"channels": ["Security"],
"event_codes": [4720],
"group_by": ["host", "user"],
"threshold": 1,
"window_seconds": 300,
"suppress_seconds": 900,
"summary": "Benutzerkonto {user} auf {host} erstellt",
"tags": ["windows", "account-management"],
"mitre": ["T1136.001"]
},
{
"id": "win-user-enabled",
"title": "Benutzerkonto aktiviert",
"description": "Windows Security Event 4722.",
"severity": "medium",
"score": 5.5,
"enabled": true,
"kind": "event",
"channels": ["Security"],
"event_codes": [4722],
"group_by": ["host", "user"],
"threshold": 1,
"window_seconds": 300,
"suppress_seconds": 900,
"summary": "Benutzerkonto {user} auf {host} aktiviert",
"tags": ["windows", "account-management"],
"mitre": []
},
{
"id": "win-password-reset",
"title": "Passwort eines Kontos zurückgesetzt",
"description": "Windows Security Event 4724.",
"severity": "medium",
"score": 6.2,
"enabled": true,
"kind": "event",
"channels": ["Security"],
"event_codes": [4724],
"group_by": ["host", "user"],
"threshold": 1,
"window_seconds": 300,
"suppress_seconds": 900,
"summary": "Passwort für {user} auf {host} zurückgesetzt",
"tags": ["windows", "account-management", "credential"],
"mitre": ["T1098"]
},
{
"id": "win-user-deleted",
"title": "Benutzerkonto gelöscht",
"description": "Windows Security Event 4726.",
"severity": "medium",
"score": 5.8,
"enabled": true,
"kind": "event",
"channels": ["Security"],
"event_codes": [4726],
"group_by": ["host", "user"],
"threshold": 1,
"window_seconds": 300,
"suppress_seconds": 900,
"summary": "Benutzerkonto {user} auf {host} gelöscht",
"tags": ["windows", "account-management"],
"mitre": []
}
]
}

102
deploy/rules/windows-authentication.json Normal file
View File

@@ -0,0 +1,102 @@
{
"id": "windows-authentication",
"name": "Windows Authentication",
"description": "Anmelde-, Lockout-, Spray- und Kerberos/NTLM-Erkennungen.",
"version": 1,
"enabled": true,
"rules": [
{
"id": "win-account-lockout",
"title": "Account Lockout",
"description": "Windows Security Event 4740.",
"severity": "medium",
"score": 5.5,
"enabled": true,
"kind": "event",
"channels": ["Security"],
"event_codes": [4740],
"group_by": ["host", "user", "workstation"],
"threshold": 1,
"window_seconds": 600,
"suppress_seconds": 900,
"summary": "Account-Lockout: {user}; Caller {workstation}; DC/Host {host} ({count}×)",
"tags": ["windows", "authentication", "lockout"],
"mitre": []
},
{
"id": "win-failed-logon-burst",
"title": "Viele fehlgeschlagene Anmeldungen",
"description": "Mindestens 20 Event-4625-Ereignisse für denselben Kontext in fünf Minuten.",
"severity": "high",
"score": 7.5,
"enabled": true,
"kind": "threshold",
"channels": ["Security"],
"event_codes": [4625],
"group_by": ["host", "user", "source_ip"],
"threshold": 20,
"window_seconds": 300,
"suppress_seconds": 900,
"summary": "{count} fehlgeschlagene Logons für {user} auf {host} von {source_ip}",
"tags": ["windows", "authentication", "brute-force"],
"mitre": ["T1110"]
},
{
"id": "win-password-spray",
"title": "Password Spray",
"description": "Eine Source-IP versucht viele unterschiedliche Konten anzumelden.",
"severity": "high",
"score": 8.5,
"enabled": true,
"kind": "distinct",
"channels": ["Security"],
"event_codes": [4625],
"conditions": [{"field": "source_ip", "operator": "exists"}, {"field": "target_user", "operator": "exists"}],
"group_by": ["source_ip"],
"threshold": 20,
"distinct_field": "target_user",
"distinct_threshold": 10,
"window_seconds": 600,
"suppress_seconds": 1800,
"summary": "Password-Spray von {source_ip}: {count} Versuche gegen {distinct} Benutzer",
"tags": ["windows", "authentication", "password-spray"],
"mitre": ["T1110.003"]
},
{
"id": "win-kerberos-preauth-burst",
"title": "Kerberos Pre-Auth Fehler-Burst",
"description": "Viele Event-4771-Ereignisse für denselben Benutzer oder Quellkontext.",
"severity": "high",
"score": 7.4,
"enabled": true,
"kind": "threshold",
"channels": ["Security"],
"event_codes": [4771],
"group_by": ["host", "user", "source_ip"],
"threshold": 15,
"window_seconds": 300,
"suppress_seconds": 900,
"summary": "{count} Kerberos Pre-Auth Fehler für {user} auf {host} von {source_ip}",
"tags": ["windows", "kerberos", "authentication"],
"mitre": ["T1110"]
},
{
"id": "win-ntlm-auth-failure-burst",
"title": "NTLM Authentifizierungsfehler-Burst",
"description": "Viele Event-4776-Ereignisse im kurzen Zeitraum.",
"severity": "high",
"score": 7.2,
"enabled": true,
"kind": "threshold",
"channels": ["Security"],
"event_codes": [4776],
"group_by": ["host", "user", "workstation"],
"threshold": 15,
"window_seconds": 300,
"suppress_seconds": 900,
"summary": "{count} NTLM-Authentifizierungsfehler für {user} über {workstation}",
"tags": ["windows", "ntlm", "authentication"],
"mitre": ["T1110"]
}
]
}

98
deploy/rules/windows-core.json Normal file
View File

@@ -0,0 +1,98 @@
{
"id": "windows-core",
"name": "Windows Core Security",
"description": "Hochwertige Windows-System- und Audit-Ereignisse mit geringer Grundlautstärke.",
"version": 1,
"enabled": true,
"rules": [
{
"id": "win-audit-log-cleared",
"title": "Security Audit Log gelöscht",
"description": "Windows Security Event 1102.",
"severity": "critical",
"score": 9.8,
"enabled": true,
"kind": "event",
"channels": ["Security"],
"event_codes": [1102],
"group_by": ["host"],
"threshold": 1,
"window_seconds": 300,
"suppress_seconds": 900,
"summary": "Security Audit Log auf {host} wurde gelöscht",
"tags": ["windows", "audit", "defense-evasion"],
"mitre": ["T1070.001"]
},
{
"id": "win-service-installed",
"title": "Neuer Windows-Dienst installiert",
"description": "Service Control Manager Event 7045.",
"severity": "high",
"score": 8.0,
"enabled": true,
"kind": "event",
"event_codes": [7045],
"group_by": ["host", "process_path"],
"threshold": 1,
"window_seconds": 300,
"suppress_seconds": 900,
"summary": "Neuer Dienst auf {host} installiert: {process}",
"tags": ["windows", "persistence", "service"],
"mitre": ["T1543.003"]
},
{
"id": "win-scheduled-task-created",
"title": "Scheduled Task erstellt",
"description": "Windows Security Event 4698.",
"severity": "high",
"score": 7.8,
"enabled": true,
"kind": "event",
"channels": ["Security"],
"event_codes": [4698],
"group_by": ["host", "user"],
"threshold": 1,
"window_seconds": 300,
"suppress_seconds": 900,
"summary": "Scheduled Task auf {host} durch {user} erstellt",
"tags": ["windows", "persistence", "scheduled-task"],
"mitre": ["T1053.005"]
},
{
"id": "win-audit-policy-changed",
"title": "Audit Policy geändert",
"description": "Windows Security Event 4719.",
"severity": "high",
"score": 8.2,
"enabled": true,
"kind": "event",
"channels": ["Security"],
"event_codes": [4719],
"group_by": ["host", "user"],
"threshold": 1,
"window_seconds": 300,
"suppress_seconds": 900,
"summary": "Audit Policy auf {host} durch {user} geändert",
"tags": ["windows", "audit", "policy"],
"mitre": ["T1562.002"]
},
{
"id": "win-firewall-rule-change",
"title": "Windows Firewall-Regel geändert",
"description": "Firewall-Regeln hinzugefügt, geändert oder gelöscht.",
"severity": "medium",
"score": 5.5,
"enabled": true,
"kind": "threshold",
"channels": ["Security"],
"event_codes": [4946, 4947, 4948],
"group_by": ["host", "user"],
"threshold": 1,
"window_seconds": 300,
"suppress_seconds": 900,
"summary": "Windows Firewall-Regel auf {host} geändert ({count} Ereignisse)",
"tags": ["windows", "firewall", "configuration"],
"mitre": ["T1562.004"]
}
]
}

81
deploy/rules/windows-defender-powershell.json Normal file
View File

@@ -0,0 +1,81 @@
{
"id": "windows-defender-powershell",
"name": "Windows Defender & PowerShell",
"description": "Malware-, Defender- und auffällige PowerShell-Signale.",
"version": 1,
"enabled": true,
"rules": [
{
"id": "defender-malware-detected",
"title": "Microsoft Defender Malware erkannt",
"description": "Defender Operational Event 1116.",
"severity": "high",
"score": 8.8,
"enabled": true,
"kind": "event",
"event_codes": [1116],
"conditions": [{"field": "provider", "operator": "contains", "value": "Defender"}],
"group_by": ["host"],
"threshold": 1,
"window_seconds": 300,
"suppress_seconds": 1800,
"summary": "Microsoft Defender meldet Malware auf {host}",
"tags": ["windows", "defender", "malware"],
"mitre": []
},
{
"id": "defender-realtime-protection-disabled",
"title": "Defender Echtzeitschutz deaktiviert",
"description": "Defender Operational Event 5001.",
"severity": "critical",
"score": 9.0,
"enabled": true,
"kind": "event",
"event_codes": [5001],
"conditions": [{"field": "provider", "operator": "contains", "value": "Defender"}],
"group_by": ["host"],
"threshold": 1,
"window_seconds": 300,
"suppress_seconds": 1800,
"summary": "Microsoft Defender Echtzeitschutz auf {host} deaktiviert",
"tags": ["windows", "defender", "defense-evasion"],
"mitre": ["T1562.001"]
},
{
"id": "powershell-encoded-command",
"title": "PowerShell EncodedCommand",
"description": "PowerShell-Nachricht oder Kommandozeile enthält EncodedCommand.",
"severity": "high",
"score": 8.0,
"enabled": true,
"kind": "event",
"event_codes": [4104, 4688],
"conditions": [{"field": "message", "operator": "contains", "value": "EncodedCommand"}],
"group_by": ["host", "user"],
"threshold": 1,
"window_seconds": 300,
"suppress_seconds": 900,
"summary": "PowerShell EncodedCommand auf {host} durch {user}",
"tags": ["windows", "powershell", "execution"],
"mitre": ["T1059.001", "T1027"]
},
{
"id": "powershell-download-cradle",
"title": "PowerShell Download-/Execution-Muster",
"description": "PowerShell ScriptBlock enthält typische Download- oder In-Memory-Execution-Muster.",
"severity": "high",
"score": 8.4,
"enabled": true,
"kind": "event",
"event_codes": [4104],
"conditions": [{"field": "message", "operator": "regex", "value": "(?i)(DownloadString|DownloadFile|Invoke-WebRequest|FromBase64String|IEX\\s*\\()"}],
"group_by": ["host", "user"],
"threshold": 1,
"window_seconds": 300,
"suppress_seconds": 900,
"summary": "Auffälliges PowerShell Download-/Execution-Muster auf {host} durch {user}",
"tags": ["windows", "powershell", "execution"],
"mitre": ["T1059.001", "T1105"]
}
]
}